Rabbit R1s break after elevenlabs key revoked | Hacker News Reader

Rabbit R1s break after elevenlabs key revoked

twitter.com

76 pointsjrflowers24 comments

Rabbit data breach (48 points, 2 hours ago, 11 comments) https://news.ycombinator.com/item?id=40792684

Rabbit R1: a fun, funky, unfinished AI gadget (40 points, 2 months ago, 69 comments) https://news.ycombinator.com/item?id=40145078

Rabbit R1 source code (353 points, 2 months ago, 189 comments) https://news.ycombinator.com/item?id=40135250

What's the hiring process like for those ChatGPT-of-the-month positions that pay 2-3x market rate? This looks like something a fresh bootcamp grad would do.

Are those real jobs or just signaling?

Sorry, I am misunderstanding your question, because it sounds like you're asking if Rabbit Inc ever employed a human.

I was flippantly suggesting that these job postings at very high wages are not real jobs to be filled but exist to draw attention to the company/signal that they are a FAANG level company.

Had to look it up...

The Rabbit r1 is a ChatGPT based personal assistant device developed by tech startup Rabbit Inc,

https://en.m.wikipedia.org/wiki/Rabbit_r1

So not an adult toy (Rule 34 excepting)

It's always interesting to come across someone who only came across a thing for the first time, after you yourself came across it organically hundreds of different places. We all live in such different microcosms.

yet. .... this inevitably summons qdot.

Apparently their TTS service is already back online, but more interesting is the original post about why the keys were revoked

https://rabbitu.de/articles/security-disclosure-1

tl;dr they had hardcoded their Elevenlabs admin keys into their client, which allowed anyone to access the entire history of TTS responses for every Rabbit R1 user

They didn't hardcode it into the client (source: I have personally RE'd their client code[0]), they hardcoded it into their server-side code, which certain security researchers claim[1] to have (had) access to.

[0] https://gist.github.com/DavidBuchanan314/aafce6ba7fc49b19206...

[1] https://rabbitu.de/articles/security-disclosure-1

"rabbit inc has known that we have had their elevenlabs (tts) api key for a month, but they have taken no action to rotate the api keys."

oof

Oh this is bad. Real bad.

Is it? Did anyone take that product seriously?

Data breaches and leaks involving personal data is always bad.

Supposedly, ~130K customers did

Who knew there were that many people doing tech reviews on YT?

For who? The grifters who are about to get sued into bankruptcy, or the hipsters who bought into the snake oil and are now out $199?

I would rate this as a "well, anyway...".

> which allowed anyone to access the entire history of TTS responses

A lot of people are going to get scammed... again.

Was the key also able to be used to generate text to speech?

Bad look for Rabbit. This may also bring some unnecessary heat to Elevenlabs if they're not adding "idiot disclaimers" to their secret key pages.

Dozens of users affected.

It's clear that they had absolutely no plan to deal with a compromised key. When approached, they probably have been trying to figure out the issue, are simply stuck in an unfixable state because they keys can't be rotated reliably.

Now that the issue is publicly known, they can't run their devices safely anymore.

I am willing to bet that you don't need their "codebase" as the Rabbitude hackers used, I bet these keys are hardcoded into the devices themselves, and that the key could probably be known within an hour or so and used to wreak havok.

So they opted to brick every R1, likely requiring a recovery on a PC using USB, and they need to work out their API key issue before they can ship anything, because there's a chance that any update would get compromised immediately too.

I hope every aspect of this grift is studied thoroughly so that investors understand not to throw money at people this unserious anymore.

I would be astonished (but pleased) if investors started asking difficult questions about key management processes.

Based on what I’ve heard about the Rabbit, if investors asked hard questions Rabbit wouldn’t have any investors.

Reply on news.ycombinator.com